/src/suricata8/src/detect-engine-helper.c
Line | Count | Source |
1 | | /* Copyright (C) 2023 Open Information Security Foundation |
2 | | * |
3 | | * You can copy, redistribute or modify this Program under the terms of |
4 | | * the GNU General Public License version 2 as published by the Free |
5 | | * Software Foundation. |
6 | | * |
7 | | * This program is distributed in the hope that it will be useful, |
8 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
9 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
10 | | * GNU General Public License for more details. |
11 | | * |
12 | | * You should have received a copy of the GNU General Public License |
13 | | * version 2 along with this program; if not, write to the Free Software |
14 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
15 | | * 02110-1301, USA. |
16 | | */ |
17 | | |
18 | | /** |
19 | | * \file |
20 | | * |
21 | | * \author Philippe Antoine <p.antoine@catenacyber.fr> |
22 | | * |
23 | | */ |
24 | | |
25 | | #include "suricata-common.h" |
26 | | #include "detect-engine.h" |
27 | | #include "detect-engine-helper.h" |
28 | | #include "detect-engine-mpm.h" |
29 | | #include "detect-engine-prefilter.h" |
30 | | #include "detect-parse.h" |
31 | | #include "detect-engine-content-inspection.h" |
32 | | #include "rust.h" |
33 | | |
34 | | int SCDetectHelperBufferRegister(const char *name, AppProto alproto, uint8_t direction) |
35 | 1.52k | { |
36 | 1.52k | if (direction & STREAM_TOSERVER) { |
37 | 1.32k | DetectAppLayerInspectEngineRegister( |
38 | 1.32k | name, alproto, SIG_FLAG_TOSERVER, 0, DetectEngineInspectGenericList, NULL); |
39 | 1.32k | } |
40 | 1.52k | if (direction & STREAM_TOCLIENT) { |
41 | 1.28k | DetectAppLayerInspectEngineRegister( |
42 | 1.28k | name, alproto, SIG_FLAG_TOCLIENT, 0, DetectEngineInspectGenericList, NULL); |
43 | 1.28k | } |
44 | 1.52k | return DetectBufferTypeRegister(name); |
45 | 1.52k | } |
46 | | |
47 | | int SCDetectHelperBufferProgressRegister( |
48 | | const char *name, AppProto alproto, uint8_t direction, int progress) |
49 | 78 | { |
50 | 78 | if (direction & STREAM_TOSERVER) { |
51 | 78 | DetectAppLayerInspectEngineRegister( |
52 | 78 | name, alproto, SIG_FLAG_TOSERVER, progress, DetectEngineInspectGenericList, NULL); |
53 | 78 | } |
54 | 78 | if (direction & STREAM_TOCLIENT) { |
55 | 78 | DetectAppLayerInspectEngineRegister( |
56 | 78 | name, alproto, SIG_FLAG_TOCLIENT, progress, DetectEngineInspectGenericList, NULL); |
57 | 78 | } |
58 | 78 | return DetectBufferTypeRegister(name); |
59 | 78 | } |
60 | | |
61 | | int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto, |
62 | | uint8_t direction, InspectionSingleBufferGetDataPtr GetData) |
63 | 1.16k | { |
64 | 1.16k | if (direction & STREAM_TOSERVER) { |
65 | 1.01k | DetectAppLayerInspectEngineRegisterSingle( |
66 | 1.01k | name, alproto, SIG_FLAG_TOSERVER, 0, DetectEngineInspectBufferSingle, GetData); |
67 | 1.01k | DetectAppLayerMpmRegisterSingle( |
68 | 1.01k | name, SIG_FLAG_TOSERVER, 2, PrefilterSingleMpmRegister, GetData, alproto, 0); |
69 | 1.01k | } |
70 | 1.16k | if (direction & STREAM_TOCLIENT) { |
71 | 778 | DetectAppLayerInspectEngineRegisterSingle( |
72 | 778 | name, alproto, SIG_FLAG_TOCLIENT, 0, DetectEngineInspectBufferSingle, GetData); |
73 | 778 | DetectAppLayerMpmRegisterSingle( |
74 | 778 | name, SIG_FLAG_TOCLIENT, 2, PrefilterSingleMpmRegister, GetData, alproto, 0); |
75 | 778 | } |
76 | 1.16k | DetectBufferTypeSetDescriptionByName(name, desc); |
77 | 1.16k | return DetectBufferTypeGetByName(name); |
78 | 1.16k | } |
79 | | |
80 | | int SCDetectHelperBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto, |
81 | | uint8_t direction, InspectionSingleBufferGetDataPtr GetData, int progress) |
82 | 468 | { |
83 | 468 | if (direction & STREAM_TOSERVER) { |
84 | 468 | DetectAppLayerInspectEngineRegisterSingle(name, alproto, SIG_FLAG_TOSERVER, progress, |
85 | 468 | DetectEngineInspectBufferSingle, GetData); |
86 | 468 | DetectAppLayerMpmRegisterSingle( |
87 | 468 | name, SIG_FLAG_TOSERVER, 2, PrefilterSingleMpmRegister, GetData, alproto, progress); |
88 | 468 | } |
89 | 468 | if (direction & STREAM_TOCLIENT) { |
90 | 117 | DetectAppLayerInspectEngineRegisterSingle(name, alproto, SIG_FLAG_TOCLIENT, progress, |
91 | 117 | DetectEngineInspectBufferSingle, GetData); |
92 | 117 | DetectAppLayerMpmRegisterSingle( |
93 | 117 | name, SIG_FLAG_TOCLIENT, 2, PrefilterSingleMpmRegister, GetData, alproto, progress); |
94 | 117 | } |
95 | 468 | DetectBufferTypeSetDescriptionByName(name, desc); |
96 | 468 | return DetectBufferTypeGetByName(name); |
97 | 468 | } |
98 | | |
99 | | int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc, |
100 | | AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress) |
101 | 1.01k | { |
102 | 1.01k | if (direction & STREAM_TOSERVER) { |
103 | 897 | DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2); |
104 | 897 | } |
105 | 1.01k | if (direction & STREAM_TOCLIENT) { |
106 | 741 | DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOCLIENT, progress, GetData, 2); |
107 | 741 | } |
108 | 1.01k | DetectBufferTypeSupportsMultiInstance(name); |
109 | 1.01k | DetectBufferTypeSetDescriptionByName(name, desc); |
110 | 1.01k | return DetectBufferTypeGetByName(name); |
111 | 1.01k | } |
112 | | |
113 | | int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto, |
114 | | uint8_t direction, InspectionMultiBufferGetDataPtr GetData) |
115 | 819 | { |
116 | 819 | return SCDetectHelperMultiBufferProgressMpmRegister(name, desc, alproto, direction, GetData, 0); |
117 | 819 | } |
118 | | |
119 | | int SCDetectHelperNewKeywordId(void) |
120 | 12.7k | { |
121 | 12.7k | if (DETECT_TBLSIZE_IDX >= DETECT_TBLSIZE) { |
122 | 0 | void *tmp = SCRealloc( |
123 | 0 | sigmatch_table, (DETECT_TBLSIZE + DETECT_TBLSIZE_STEP) * sizeof(SigTableElmt)); |
124 | 0 | if (unlikely(tmp == NULL)) { |
125 | 0 | return -1; |
126 | 0 | } |
127 | 0 | sigmatch_table = tmp; |
128 | 0 | memset(&sigmatch_table[DETECT_TBLSIZE], 0, DETECT_TBLSIZE_STEP * sizeof(SigTableElmt)); |
129 | 0 | DETECT_TBLSIZE += DETECT_TBLSIZE_STEP; |
130 | 0 | } |
131 | | |
132 | 12.7k | DETECT_TBLSIZE_IDX++; |
133 | 12.7k | return DETECT_TBLSIZE_IDX - 1; |
134 | 12.7k | } |
135 | | |
136 | | uint16_t SCDetectHelperKeywordRegister(const SCSigTableAppLiteElmt *kw) |
137 | 10.4k | { |
138 | 10.4k | int keyword_id = SCDetectHelperNewKeywordId(); |
139 | 10.4k | if (keyword_id < 0) { |
140 | 0 | return -1; |
141 | 0 | } |
142 | | |
143 | 10.4k | sigmatch_table[keyword_id].name = kw->name; |
144 | 10.4k | sigmatch_table[keyword_id].desc = kw->desc; |
145 | 10.4k | sigmatch_table[keyword_id].url = kw->url; |
146 | 10.4k | sigmatch_table[keyword_id].flags = kw->flags; |
147 | 10.4k | sigmatch_table[keyword_id].AppLayerTxMatch = |
148 | 10.4k | (int (*)(DetectEngineThreadCtx * det_ctx, Flow * f, uint8_t flags, void *alstate, |
149 | 10.4k | void *txv, const Signature *s, const SigMatchCtx *ctx)) kw->AppLayerTxMatch; |
150 | 10.4k | sigmatch_table[keyword_id].Setup = |
151 | 10.4k | (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup; |
152 | 10.4k | sigmatch_table[keyword_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free; |
153 | | |
154 | 10.4k | return (uint16_t)keyword_id; |
155 | 10.4k | } |
156 | | |
157 | | void SCDetectHelperKeywordAliasRegister(uint16_t kwid, const char *alias) |
158 | 639 | { |
159 | 639 | sigmatch_table[kwid].alias = alias; |
160 | 639 | } |
161 | | |
162 | | int SCDetectHelperTransformRegister(const SCTransformTableElmt *kw) |
163 | 1.38k | { |
164 | 1.38k | int transform_id = SCDetectHelperNewKeywordId(); |
165 | 1.38k | if (transform_id < 0) { |
166 | 0 | return -1; |
167 | 0 | } |
168 | | |
169 | 1.38k | sigmatch_table[transform_id].name = kw->name; |
170 | 1.38k | sigmatch_table[transform_id].desc = kw->desc; |
171 | 1.38k | sigmatch_table[transform_id].url = kw->url; |
172 | 1.38k | sigmatch_table[transform_id].flags = kw->flags; |
173 | 1.38k | sigmatch_table[transform_id].Transform = |
174 | 1.38k | (void (*)(DetectEngineThreadCtx * det_ctx, InspectionBuffer * buffer, void *options)) |
175 | 1.38k | kw->Transform; |
176 | 1.38k | sigmatch_table[transform_id].TransformValidate = (bool (*)( |
177 | 1.38k | const uint8_t *content, uint16_t content_len, void *context))kw->TransformValidate; |
178 | 1.38k | sigmatch_table[transform_id].Setup = |
179 | 1.38k | (int (*)(DetectEngineCtx * de, Signature * s, const char *raw)) kw->Setup; |
180 | 1.38k | sigmatch_table[transform_id].Free = (void (*)(DetectEngineCtx * de, void *ptr)) kw->Free; |
181 | 1.38k | sigmatch_table[transform_id].TransformId = |
182 | 1.38k | (void (*)(const uint8_t **id_data, uint32_t *length, void *context))kw->TransformId; |
183 | | |
184 | 1.38k | return transform_id; |
185 | 1.38k | } |